The bet that the circuits behind ZK rollups and privacy apps say exactly what they should, with no missing rules or bugs.
The idea: A circuit is the rulebook a proof is checked against. If the rulebook forgets a rule, say "the output balance equals the input balance", then a proof of a false statement checks out perfectly: the cryptography did its job on the wrong rulebook. That's why most real ZK failures have been bugs like this rather than broken math.
Why it matters: A missing constraint lets someone prove something false, like minting funds, without breaking any math.
On the map: rollup and privacy-app circuits and provers. Under-constrained circuits are a common bug class
A zero-knowledge proof only proves what its circuit says. If the circuit forgets a constraint (an "under-constrained" circuit)[1], or the prover or verifier code has a bug, someone can prove false statements, such as minting funds on a rollup or withdrawing twice from a privacy pool, without breaking any cryptography.
A 2024 study of 141 publicly disclosed SNARK vulnerabilities (Chaliasos et al., USENIX Security)[2] found that about 70% were in the circuits themselves, many of them missing constraints. That is why ZK rollups keep security councils or several independent provers. The planned zkVM proofs of whole blocks face the same risk at a larger scale (the "proof systems are sound and bug-free" box in the not-live section).
If any of these breaks, this breaks too.
If this breaks, these break with it.